On January 2, 2018, U.S. District Court Judge Barbara Rothstein ruled that PricewaterhouseCoopers (PwC) negligently failed to uncover a $2.3 billion fraud scheme between PwC audit client Colonial Bank and Taylor, Bean & Whitaker. Colonial Bank is now in receivership under Federal Deposit Insurance Corporation (FDIC) rules. Taylor Bean is a bankrupt mortgage lender. PwC already paid an undisclosed amount in 2016 to settle related claims by Taylor Bean's trustee.1 The decision in the case means it now moves into a damages phase, where the FDIC is seeking as much as $2.1 billion.

The collapse of Colonial Bank, which had $25 billion in assets and $20 billion in deposits, was the biggest bank failure of 2009. The FDIC estimates Colonial's failure will ultimately cost its insurance fund $5 billion, making it one of the most expensive bank failures in U.S. history. The lawsuit against PwC was the first of its kind filed against an accounting firm in the aftermath of the financial recession. On August 12, 2012, some former Colonial Bank directors and officers agreed to settle the securities class action lawsuit against them for the bank's collapse. The settlement did not include PwC.

While Judge Rothstein held PwC liable for negligence, it rejected similar claims by the bankruptcy trustee for Colonial Banc Group because the bank itself was responsible for the fraud. That professional negligence claim was barred by the in pari delicto doctrine and the audit interference rule. Latin for "in equal fault," in pari delicto means, if the fault of the fraud is more or less equal between two or more parties (i.e., Colonial Bank and PwC), neither party can claim breach of the contract by the other. The audit interference rule holds that an auditor may assert a comparative-fault defense where it can establish that the client's negligence "interfered with" the auditor's performance of its duties, as in the Colonial Bank case.

In her opinion, Judge Rothstein emphasized that PwC had relied on the chief architect of the fraud, Taylor Bean chair Lee Farkas, to verify key information about the collateral underlying a Colonial credit facility for Taylor Bean. PwC signed off on Colonial's audit without ever understanding the underlying accounting event, which was based on phantom mortgage securitizations. PwC allowed Colonial to account for certain types of mortgages from Taylor Bean as sales rather than as loans from Colonial to Taylor Bean that were secured by mortgages.

Judge Rothstein ruled PwC was guilty of professional negligence. It rapped the firm for following "illogical dates" and to check whether an entire class of loans—nearly 20 percent of its mortgage lending warehouse—existed. She also cited testimony from a PwC partner in an earlier, related case that "our audit procedures were not designed to detect fraud."

PwC gave the bank's parent, Colonial Banc Group, a clean audit opinion for years before it was disclosed that substantial portions of Colonial's loans to Taylor Bean were secured against assets that did not exist. In the malpractice case, Judge Rothstein agreed with the FDIC that PwC failed to meet professional accounting standards in its audits of Colonial. "PwC did not design its audits to detect fraud and PwC's failure to do so constitutes a violation of the auditing standards," 

PwC Defense of Audit

PwC, in its defense, said it was duped by Farkas, who skimmed millions of dollars from Colonial to buy a private jet, vintage cars, and a vacation home. Rothstein had ruled that Colonial executives lied to PwC's auditors, circumvented internal controls by "recycling" mortgage data, and even created wire transfers to trick PwC into believing Taylor Bean's collateral mortgages had been paid off.
 
PwC put its own spin on the verdict by stating that the court's ruling recognized that in addition to those Colonial Bank employees who perpetrated the fraud, numerous other employees at Colonial Banc Group actively and substantially interfered with their audit. But Rothstein faulted PwC for failing to inspect or even request to inspect the underlying documents for some Taylor Bean mortgages. "PwC argues that even if it had attempted to inspect the underlying loan documents, it would not have uncovered the fraud because the fraudsters would simply have created fake documents. This, of course, is something that we will never know."

Elizabeth Tanis, PwC's lead trial counsel said, "As the professional audit standards make clear, even a properly-designed and executed audit may not detect fraud, especially in instances when there is collusion, fabrication of documents, and the override of controls, as there was at Colonial Bank."
PwC has maintained in court documents that its responsibility is to follow accounting principles—which might not necessarily detect fraud.

A rather unusual aspect to the claim that PwC did not follow appropriate professional standards is the allegation that PwC did not understand the nature and scope of the transactions. After a PwC auditor who was supposed to make sense of the transactions gave up, saying they were "above his pay grade," PwC assigned a college-graduate intern to evaluate the nearly $600 million asset. Rothstein was distinctly harsh about PwC's failings. Basing Colonial's certification on Farkas' account of Taylor Bean's collateral was "quintessentially the same as asking the fox to report on the condition of the hen house." She added that expecting an intern to decipher a loan facility beyond the expertise of a senior auditor was a "truly astonishing" departure from PwC's mandate

Internal Audit and ICFR

Colonial Bank had outsourced internal audit to another accounting firm, Crowe Horwath. PwC was required to review Crowe's work product, and it did so. Crowe, however, never identified or performed any evaluation of internal controls specifically relating to the credit facility, and there was no documentation suggesting otherwise. Nonetheless, PwC concluded that internal controls for Colonial's Treasury operation (including the credit facility) were effective and could be relied upon by PwC to reduce its substantive audit procedures. PwC reached this conclusion in the absence of any evidence that Crowe (or anyone else) had tested any internal controls for the credit facility.

Digging deeper, PwC knew that Colonial's Treasury and Securities Purchased Under Agreements to Resell (which included $51.5 billion in credit facility financing for Taylor Bean at December 31, 2007) was a "Significant Process" for which it would test controls. During the actual audit, however, PwC excluded the credit facility entirely from the key controls that it tested despite the credit facility significant account balance and distinct class of transactions that called for transaction-specific controls.

PwC did not perform any walkthrough, skipping this crucial step because key controls were not identified by Crowe, and/or PwC did not properly assess the inherent risks regarding the existence and validity of credit facility assets. PwC instead decided that it would rely on Crowe to perform all walkthroughs.

The FDIC's claims against Crowe Horwath, who acted under a consulting contract as Colonial's internal audit department, were unusual. PwC's workpapers gave FDIC a glimpse into PwC's opinion of the quality of Crowe's work. Regardless of what PwC thought, the FDIC believed that PwC did not do enough to compensate for any failings or verify the assertions about internal controls Crowe made on behalf of Colonial management.

The FDIC asserted gross negligence by Crowe. Allegedly, there was concealment and collusion to perpetrate a fraud within the bank and from outside sources. Crowe was held to the AICPA's standards for consulting work which, while stringent as the AICPA Code of Professional Conduct standards, do not carry the force of law that the Sarbanes-Oxley page 452Act and the PCAOB auditing standards do. The FDIC also maintained that Crowe should have followed the professional standards promulgated by the Institute of Internal Auditors. Would an internal audit function staffed by Colonial employees instead of an outside consultant have been sued under the same circumstances? On April 4, 2018, the FDIC settled its claims of professional malpractice and breach of contract against Crowe, disclosing that Crowe will make a $60 million payment to the FDIC.

On March 15, 2019, the FDIC announced that it had reached a $335 million settlement of the negligence action the agency had brought against PwC in connection with the accounting firm's audit work for Colonial Bank. The curious thing about this settlement is that it represents only a little more than half of the amount that a federal district court judge awarded the FDIC as damages in a July 2018 order in the case.

The Colonial ruling marks the first time an auditor has been held liable for fraud in many years. Lawyers who defended auditors were outraged by the ruling, calling it "an aggressive interpretation," "extremely disturbing," and a "one-off decision that will be reversed upon appeal." They are particularly upset that the case ever went to trial. In most auditing failure cases, companies are barred from suing their auditors for failing to detect fraud if—as happened at Colonial—their employees actively participated in the malfeasance. But in this case, the bank went bankrupt, and the FDIC sued to recover money for taxpayers. Courts around the country are split on whether the government can do that, and Judge Rothstein opted to let the FDIC sue. Attorney Michael Dell argued that the Colonial decision would fundamentally change the nature of auditing: "Audit firms would effectively be insurers for the wrongdoing of their clients." If the ruling stands, some lawyers believe investors will find it easier to hold auditors accountable in future corporate fraud cases

Questions

1.) Which rules of conduct in the AICPA Code of Professional Conduct were violated by PwC? Explain.

2.) Which PCAOB auditing standards were violated by PwC? Explain why those violations occurred and whether PwC should be held responsible.

3.) Attorney Michael Dell argued that the Colonial Bank ruling would effectively hold audit firms liable for the wrongdoing of their clients. Is that the way you read the facts of the case and Judge Rothstein's ruling? Is there anything wrong with holding auditors responsible for the wrongdoing of their clients when client employees actively participate in the malfeasance? Explain.

4.) When should auditors disclose critical audit matters (CAMs)? Assume the Colonial Bank case occurred subsequent to the effective dates of the new auditing standard on disclosing CAMs. Which disclosures should PwC have included in the audit report of Colonial Bank?